YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 5faee4ecf4701ac7b00496d55561e51546242ac1e17993ac32193a09a7df805f.

Scan Results

SHA256 hash: 5faee4ecf4701ac7b00496d55561e51546242ac1e17993ac32193a09a7df805f
File size:3'145'048 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 1fc5f5964ce1dbb8b40d530c3565a15c
SHA1 hash: 10a9ba4153d9ce63dc19621e45c6d7125dad88cd
SHA3-384 hash: 6245076c11416c82077e2090bb8d6b4309363ece5c615c50373026850fc4927c0bdecab892be15c6ce55713f6a8f0256
First seen:2026-03-29 17:22:35 UTC
Last seen:Never
Sightings:1
imphash : 53d02dee8a3558f2a2295b34eb0d6374
Create hunting rule
ssdeep : 49152:9bYwIkppGoaZ2hTBLzT2lph7GBfWRpEf2hvZPzN/xw6n1wRjJm6dRJm:ycvaGC77GBfWkf2xZPzNsBRQ
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : f8ba6c0e0ec982c0
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:e0a24d6f-2b93-11f1-b47f-42010aa4000b
File name:1fc5f5964ce1dbb8b40d530c3565a15c
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.W32.Agent.3D58.tr.1259.14147.UNOFFICIAL
Create hunting rule
Signature:SecuriteInfo.com.W32.Agent.CPL.tr.12645.18404.UNOFFICIAL
Create hunting rule
Signature:Win.Dropper.Tiggre-9845940-0
Create hunting rule
Signature:Win.Malware.Score-6940809-0
Create hunting rule
Signature:Win.Trojan.Qhost-160
Create hunting rule
Signature:YARA.DITEKSHEN_MALWARE_Win_Blackmoon.UNOFFICIAL
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:BlackMoon
Create hunting rule
Author:NDA0E
Description:Detects BlackMoon
TLP:TLP:WHITE
Repository:YARAify
Rule name:blackmoon_payload_v1
Create hunting rule
Author:RandomMalware
TLP:TLP:WHITE
Repository:YARAify
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
TLP:TLP:WHITE
Repository:YARAify
Rule name:MALWARE_Win_BlackMoon
Create hunting rule
Author:ditekSHen
Description:Detects executables using BlackMoon RunTime
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:NET
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
TLP:TLP:WHITE
Repository:YARAify
Rule name:virustotal
Create hunting rule
Author:Tracel
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.